CVE-2026-129102 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Cudy TR3000 routers before 2.5.42 let an authenticated administrator inject newlines into the IPsec keyexchange field of the vpn.set_conf RPC, adding a second leftupdown directive to ipsec.conf. StrongSwan then runs that injected command as root when a peer establishes a CHILD_SA, so an attacker gets root on the device.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Cudy TR3000 routers running firmware before 2.5.42 that expose the IPsec VPN feature are exposed; the attack needs an administrator login first. Routers with no admin credentials at risk, or with the VPN feature unused, are less exposed; the sources do not say whether VPN must be enabled for the RPC to be reachable.
Not affected if auth-required, firmware-2.5.42-or-later
Who cares cudy, ipsec, router, self-hosted, strongswan, tr3000
2.5.42.2.5.42 or later.Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into the IPsec keyexchange field of the vpn.set_conf RPC method. Attackers can append a second leftupdown directive to ipsec.conf, which StrongSwan's updown plugin runs as root when an attacker-controlled peer establishes the CHILD_SA.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.